{"id":"CVE-2022-28345","aliases":["EUVD-2022-32797","GHSA-9h9j-m9f5-4f79"],"status":"published","title":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders...","description":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02494,"percentile":0.84782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2022-04-15T05:28:57Z","modified":"2026-06-17T04:38:24Z","products":[{"vendor":"signal","product":"signal"}],"references":[{"url":"https://github.com/zadewg/RIUS","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://sick.codes/sick-2022-42","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-42.md","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory"]},{"url":"https://blog.malwarebytes.com/social-engineering/2022/03/uri-spoofing-flaw-could-phish-whatsapp-signal-instagram-and-imessage-users/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28345"},{"url":"https://github.com/advisories/GHSA-9h9j-m9f5-4f79"}],"sources":{"cve":[{"id":"CVE-2022-28345","description":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.","status":"published","published":"2022-04-15T05:28:57Z","modified":"2024-08-03T05:56:14.765Z","updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-32797","description":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.","status":"published","published":"2022-04-15T05:28:57Z","modified":"2024-08-03T05:56:14Z","updated_at":"2026-11-03T03:25:41.002Z"}],"ghsa":[{"id":"GHSA-9h9j-m9f5-4f79","title":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders...","description":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.","status":"published","published":"2022-04-16T00:00:53Z","modified":"2023-01-27T05:01:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:41:56.335336Z"}],"nvd":[{"id":"CVE-2022-28345","description":"The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.","status":"published","published":"2022-04-15T06:15:06.597Z","modified":"2026-06-17T04:38:24.383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:15.414503Z"}]}}